[Resolved] Backdoor Graybird? and others

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\imsins.BAK

Folder::
C:\Program Files\SpywareBot

Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

currently the computer is much faster than it was 2 days ago. I did uninstall all versions of Java, and then reinstall latest version which seemed to make a big difference when you say combo fix should be on my desktop, are you referring to the program, or the log file I produced? the log file I produced is on my desk top, the program I downloaded is not on my desktop I am not 100% sure I understand what your last instruction. apologies for my slowness

In order for you to do the last fix I posted, the program combofix.exe needs to be on the desktop, it is red circle with a white x.

OK, I just sank in, (I'm new at this) give me a minute

I saved it as CFScript which is now on my desktop, but I cannot find this item you want me to drag it to

This is where you have it now. C:\Documents and Settings\Leonard Roe\Local Settings\Temporary Internet Files\Content.IE5\G82MKBBP\ComboFix[1].exe

OK, I'm stuck here. I foud the thing in C disk, I cannot figure out how to move it to desktop. right click and move to? (but that only creates a shortcut)? I appreciate your patience here, I know this must be annoying. I need baby steps here,

Right click on the file, and select cut. Move your mouse curser to the desktop, right click select paste

OK, that was just the log file text document that we produced in the scan, and it is on my desk top the one with the red and white you told me to look for is still not there.

OK let start over and please read everything before taking any actions.

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  • [external image: Posted Image]
• If shown the disclaimer, Select "2"

After the above:

Download ComboFix from Here Save it to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall

Yes sir, OK, did the run procedure and made sure it was exactly like you said with the space and I get: "Windows cannot find ComboFix…"

Move on to the next step and do the download

when I click on your download link, I don't get an exe that can be double clicked, I just get a box with the run or cancel buttons, is that correct? I do have the first log file produced, by the way that one is not what you want?

No. You should also see SAVE. Click Save and save it to your Desktop.

ok, good, it downloaded and I selected desktop, now what do I do? "RUN" "OPEN FOLDER" or "CLOSE" by the way, it is on the desktop, I checked